pdurlej/platform

Fork 0

fix(ci): trigger Patchwarden client calibration runs #649

Merged

pdurlej merged 1 commit from codex/m06-patchwarden-client-triggers into main

2026-05-30 17:27:43 +02:00

codex commented

2026-05-30 17:14:20 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Adds the missing labeled and ready_for_review triggers to patchwarden-client-dry-run.yml so the W6d calibration label and draft-to-ready transition can refresh Patchwarden client evidence without a manual push.

Canary Context Pack

Product story

Patchwarden calibration needs a reliable way to refresh PR-side dry-run evidence when a PR becomes ready or receives the calibration label.

What changed

Added labeled and ready_for_review to the Patchwarden client dry-run pull request trigger.
Added a job-level guard so generic label changes do not run the dry-run; only W6d-automerge-calibration label events pass.
Added a workflow contract test for the trigger and label guard.

Why it changed

Issue #530 identified that calibration and ready-for-review transitions were not re-running the client dry-run workflow.

Files touched

.forgejo/workflows/patchwarden-client-dry-run.yml
control-plane/platformctl/tests/test_pr_sanity.py

Relevant context

#530
Existing Patchwarden workflow trigger conventions in .forgejo/workflows/patchwarden-pr-sanity.yml

Runtime evidence

No runtime mutation. Local validation only.

Known constraints

This is workflow-trigger hygiene only; it does not change Patchwarden verdict logic or automerge policy.

Explicit out-of-scope

Other workflows
Automerge behavior
Patchwarden policy rules
Runtime services

Requested decision

Merge if workflow checks and local validation remain green.

Merge blockers

YAML/workflow lint failure
Regression in Patchwarden workflow tests

Spec sources read

#530 issue body: target workflow and acceptance criteria
.forgejo/workflows/patchwarden-client-dry-run.yml: target workflow
control-plane/platformctl/tests/test_pr_sanity.py: existing workflow contract tests

Validation

PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py - 33 passed
PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json - exitCode 0

Closes #530

Canary status: missing - fire canary 3+3 manually before merge ## Summary Adds the missing `labeled` and `ready_for_review` triggers to `patchwarden-client-dry-run.yml` so the W6d calibration label and draft-to-ready transition can refresh Patchwarden client evidence without a manual push. ## Canary Context Pack ### Product story Patchwarden calibration needs a reliable way to refresh PR-side dry-run evidence when a PR becomes ready or receives the calibration label. ### What changed - Added `labeled` and `ready_for_review` to the Patchwarden client dry-run pull request trigger. - Added a job-level guard so generic label changes do not run the dry-run; only `W6d-automerge-calibration` label events pass. - Added a workflow contract test for the trigger and label guard. ### Why it changed Issue #530 identified that calibration and ready-for-review transitions were not re-running the client dry-run workflow. ### Files touched - `.forgejo/workflows/patchwarden-client-dry-run.yml` - `control-plane/platformctl/tests/test_pr_sanity.py` ### Relevant context - #530 - Existing Patchwarden workflow trigger conventions in `.forgejo/workflows/patchwarden-pr-sanity.yml` ### Runtime evidence No runtime mutation. Local validation only. ### Known constraints This is workflow-trigger hygiene only; it does not change Patchwarden verdict logic or automerge policy. ### Explicit out-of-scope - Other workflows - Automerge behavior - Patchwarden policy rules - Runtime services ### Requested decision Merge if workflow checks and local validation remain green. ### Merge blockers - YAML/workflow lint failure - Regression in Patchwarden workflow tests ## Spec sources read - #530 issue body: target workflow and acceptance criteria - `.forgejo/workflows/patchwarden-client-dry-run.yml`: target workflow - `control-plane/platformctl/tests/test_pr_sanity.py`: existing workflow contract tests ## Validation - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py` - 33 passed - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json` - exitCode 0 Closes #530

codex added 1 commit

2026-05-30 17:14:20 +02:00

fix(ci): trigger Patchwarden client calibration runs

infra-docs-drift / docs-drift (pull_request) Successful in 6s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 23s

Details

python-ci / Python 3.12 (pull_request) Successful in 48s

Details

python-ci / Python 3.13 (pull_request) Successful in 48s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

canary-required / collect-diff (pull_request) Successful in 6s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 24s

Details

python-ci / Python 3.11 (pull_request) Successful in 46s

Details

workflow-lint / lint (pull_request) Successful in 7s

Details

canary-required / canary (pull_request) Successful in 15s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 25s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m52s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

4eeff96d13

codex added the

agent/codex

class/security-sensitive

labels

2026-05-30 17:14:41 +02:00

codex commented

2026-05-30 17:21:20 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 649
Commit: 4eeff96d13f094d18d28c74212586de572afba08
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — .forgejo/workflows/patchwarden-client-dry-run.yml
- Evidence: .forgejo/workflows/patchwarden-client-dry-run.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
medium Forgejo may not support ready_for_review pull request event type
- Evidence: .forgejo/workflows/patchwarden-client-dry-run.yml added ready_for_reviewto theon.pull_request.types list. Forgejo Actions (Gitea-based) may not implement this GitHub-specific event, causing the workflow to never trigger on draft-to-re
- Next: Verify Forgejo documentation or test manually that ready_for_review triggers the workflow. If unsupported, consider an alternative trigger (e.g., synchronize after draft conversion) or document the limitation.

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
medium Substring workflow contract tests allow logic bypass via false positives
- Evidence: control-plane/platformctl/tests/test_pr_sanity.py adds three substring assertions on the raw workflow text: assert "types: [opened, synchronize, reopened, labeled, ready_for_review]" in text, assert "github.event.action != 'labeled'" in `
- Next: Parse .forgejo/workflows/patchwarden-client-dry-run.yml with yaml.safe_load and assert on the actual node values: verify workflow['on']['pull_request']['types'] equals the expected list and that workflow['jobs']['collect-diff']['if'] evaluates to the intended expression.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `649` - Commit: `4eeff96d13f094d18d28c74212586de572afba08` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/patchwarden-client-dry-run.yml` - Evidence: `.forgejo/workflows/patchwarden-client-dry-run.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Forgejo may not support `ready_for_review` pull request event type - Evidence: `.forgejo/workflows/patchwarden-client-dry-run.yml added `ready_for_review` to the `on.pull_request.types` list. Forgejo Actions (Gitea-based) may not implement this GitHub-specific event, causing the workflow to never trigger on draft-to-re` - Next: Verify Forgejo documentation or test manually that `ready_for_review` triggers the workflow. If unsupported, consider an alternative trigger (e.g., `synchronize` after draft conversion) or document the limitation. ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`medium`** Substring workflow contract tests allow logic bypass via false positives - Evidence: `control-plane/platformctl/tests/test_pr_sanity.py adds three substring assertions on the raw workflow text: `assert "types: [opened, synchronize, reopened, labeled, ready_for_review]" in text`, `assert "github.event.action != 'labeled'" in ` - Next: Parse `.forgejo/workflows/patchwarden-client-dry-run.yml` with `yaml.safe_load` and assert on the actual node values: verify `workflow['on']['pull_request']['types']` equals the expected list and that `workflow['jobs']['collect-diff']['if']` evaluates to the intended expression. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.